zero-day
Safeguard articles tagged "zero-day" — guides, analysis, and best practices for software supply chain and application security.
83 articles
FortiGate SSL-VPN Zero-Day (CVE-2022-42475): How a Heap Overflow Gave Attackers the Keys
A heap-based buffer overflow in Fortinet's SSL-VPN was actively exploited before disclosure. State-sponsored actors used it to deploy custom implants on critical infrastructure.
The Disproof Step: Griffin AI vs Mythos
Most AI bug hunters skip the hardest step: trying to kill their own findings. Here is why Griffin AI's disproof pass is the single biggest lever on false-positive rate.
libwebp heap buffer overflow zero-day (CVE-2023-4863)
A heap buffer overflow in libwebp, actively exploited in a zero-click iOS spyware chain, exposed browsers, Electron apps, and containers alike.
ProxyNotShell CVE-2022-41040: Microsoft Exchange Under Fire Again
ProxyNotShell chained two Exchange vulnerabilities for authenticated RCE, exploited in the wild for weeks before Microsoft delivered a patch. Exchange admins were running out of patience.
Hypothesis Quality: Griffin AI vs Mythos
Two AI bug hunters can both generate hypotheses. Only one can defend them. A field study of grounded versus ungrounded hypothesis generation in zero-day discovery.
Follina (CVE-2022-30190): The Microsoft Zero-Day That Bypassed Macro Protections
A Word document, no macros enabled, and full remote code execution. Follina exploited the Microsoft Support Diagnostic Tool via ms-msdt protocol handlers, rendering years of macro-blocking defenses irrelevant.
Confluence Zero-Day (CVE-2022-26134): Atlassian's OGNL Injection Crisis
An unauthenticated RCE zero-day in Confluence Server was being actively exploited before Atlassian even knew about it. The vulnerability affected virtually every on-premise Confluence installation.
Zero-Day Discovery Pipelines: Griffin AI vs Mythos
A candid look at how Griffin AI's three-stage zero-day pipeline compares to pure-LLM Mythos-class bug hunters, and why false positive rates matter more than raw volume.
Log4Shell Vulnerability (CVE-2021-44228) Explained
The most critical vulnerability in a decade dropped on a Friday. Log4Shell affects virtually every Java application and is trivial to exploit. Here's what happened.
Zero-Day Vulnerabilities in Open Source: 2021 in Review
2021 saw a record number of zero-day exploits targeting open-source software. From Log4Shell to ProxyShell, here's what happened and what it means for defenders.
Microsoft Exchange HAFNIUM Attack: Four Zero-Days That Compromised 30,000 Organizations
Chinese state-sponsored group HAFNIUM exploited four zero-day vulnerabilities in Microsoft Exchange Server, compromising an estimated 30,000 US organizations and hundreds of thousands globally.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.